usdai-reward[.]com

This domain, usdai-reward.com, is currently flagged as an active phishing threat targeting cryptocurrency users. Registered on April 22, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain resolves to the IP address 188.114.97.3, which is hosted by CloudFlare in Canada. Infrastructure analysis reveals the use of CloudFlare nameservers (arnold.ns.cloudflare.com and karsyn.ns.cloudflare.com) and a Let's Encrypt SSL certificate, a common setup for both legitimate and malicious sites. The domain is blocked by four security feeds, including PhishDestroy, MetaMask, ScamSniffer, and SEAL, indicating a coordinated detection effort across multiple platforms. The page title, 'Just a moment...', suggests the site may be employing CloudFlare protection or a holding page, which is often used to obscure malicious content from automated scanners. While the exact nature of the phishing scheme is not yet confirmed, the domain name implies a focus on cryptocurrency rewards, potentially luring victims with promises of giveaways or airdrops. The HTTP status of 403 (Forbidden) further indicates that the site is actively restricting access, possibly to evade analysis or limit exposure to unintended visitors. Defenders should treat this domain as high-risk based on its presence on multiple blocklists and its association with known phishing infrastructure. Network-level blocking of the IP address 188.114.97.3 and the domain itself is recommended to prevent user exposure. Given the use of CloudFlare, monitoring for changes in nameserver configurations or SSL certificate updates may help track the domain's evolution. While one security vendor on VirusTotal has flagged the domain, this single detection should not be relied upon as conclusive evidence of malicious activity, but rather as supplementary data in the broader context of its blocklist status and infrastructure patterns.